About 10a Labs' Hiring Philosophy

10a Labs is the safety and threat-intelligence layer trusted by frontier AI labs, AI unicorns, Fortune 10 companies, and leading global technology platforms. Through adversarial red teaming, model evaluations, and intelligence collection, the team helps engineering, safety, and security teams stay ahead of evolving threats. As a Threat Investigator on the Investigations Team, you detect and respond to abuse, investigate the activity, draft reports, and make recommendations across abuse areas including violence, hate, mental health, CBRNE, child safety, and cyber abuse.

This is a hands-on, technical investigations role, not a generalist analyst seat. 10a Labs hires people who already have real investigative experience (Trust & Safety, national security, defense, intelligence, or law enforcement), who can query and transform data with SQL and Python, build and maintain detection pipelines, cross-reference open-source information (OSINT), and stay rigorous while context-switching across very different abuse areas. Just as important, they screen for resilience: the work involves sensitive and distressing material, and the role carries an on-call rotation, so interviewers will talk openly about how you handle hard content and urgent escalations.

The interview reflects all of that. Expect a genuine technical bar (SQL and Python plus investigative reasoning), a practical case study, and serious, direct conversations about sensitive content, on-call readiness, and mission fit on a small, high-impact team. Hiring runs through Greenhouse and the role is remote, US-based, on Pacific Time.

Quick Stats

* Typical process: around 3 to 4 rounds (recruiter screen, SQL/Python technical screen, an investigations case study or take-home, and a behavioral + team/mission-fit round). Remote, via video.

* Core focus: SQL and Python data work, OSINT and investigative judgment, report writing and recommendations, resilience with graphic content, context-switching, and mission alignment.

* Style and vibe: practical, hands-on, mission-driven; screens hard for both technical skill and emotional resilience.

* Requirements to clear early: US work authorization, ability to work PT hours (9am to 5pm PT), and willingness to join the on-call rotation (about 7 consecutive days every 2 months).

What 10a Labs Looks For

* 3+ years of investigative experience in Trust & Safety, national security, defense, intelligence, or law enforcement

* Strong SQL and Python, with the ability to develop and maintain detection pipelines

* Solid OSINT skills and sound investigative judgment under ambiguity

* Resilience handling sensitive and distressing content, including child safety material

* Ability to rapidly context-switch across domains, modalities, and abuse areas

* Mission alignment with AI safety and comfort in a fast-paced, ambiguous environment

* Bonus: AI-platform abuse and prompt-injection expertise, or professional proficiency in Arabic, Chinese, Farsi, Portuguese, Russian, or Spanish

"They wanted to see real SQL and Python, plus how I would actually work an investigation end to end." — Threat investigator candidate

"Expect honest conversations about handling graphic content and staying steady on the hardest cases." — Trust & Safety investigator

Round 1: Recruiter / Intro Screen (30 minutes)

What to Expect

An intro call with a recruiter or someone from the Investigations Team to cover your background, motivation, and the practical fit items. Expect to walk through your investigative experience and the abuse areas you have worked. They will be upfront that the work involves sexual, violent, and child-safety material, and they will want to know you can handle it. They will also confirm the hard logistics: US work authorization, PT hours, and the on-call rotation. Compensation expectations may come up here.

Example or Reported Questions

* "Walk me through your investigative background and the abuse areas you have worked."

* "Why 10a Labs, and why AI safety and threat intelligence?"

* "This work involves graphic and distressing content, including child safety. How have you handled that, and how do you take care of yourself?"

* "Are you able to work Pacific Time hours and take part in the on-call rotation?"

* "What are your compensation expectations?"

Tips

* Be ready to speak honestly and specifically about prior exposure to sensitive content and the wellbeing practices that let you sustain it. This is a real screen, not a formality.

* Tie your "why 10a" to AI safety and impact, not just "I like investigations."

* Have your logistics answers locked: PT hours, on-call, and US work authorization are hard requirements.

* Use Nora AI's Standard Mode to rehearse the screen end to end

Round 2: Technical Screen, SQL & Python (45 to 60 minutes)

What to Expect

A hands-on assessment of your ability to query, transform, and understand data, either live or as a take-home. Expect SQL (joins, aggregations, filtering large event or log data to surface suspicious activity) and Python (pulling, cleaning, and cross-referencing data, or scripting a simple detection or enrichment step). They may also probe how you would design and maintain a detection pipeline to catch repeat bad actors.

Example or Reported Questions

* "Given a table of user events, write SQL to find accounts showing this suspicious pattern."

* "How would you use Python to pull, clean, and cross-reference this dataset?"

* "Walk me through how you would design a detection rule or pipeline to catch repeat bad actors."

* "A query returns millions of rows. How do you narrow it down to the signal that matters?"

Tips

* Refresh SQL joins, window functions, aggregations, and filtering for anomaly and pattern detection.

* Be fluent in pandas-style data wrangling and writing small, readable scripts.

* Think out loud about detection logic and false-positive trade-offs. They care about judgment, not just syntax.

* Use Nora AI's Technical Mode to practice explaining your SQL and Python reasoning out loud under time pressure.

Round 3: Investigations Case Study / Take-Home

What to Expect

The core of the loop. You are given a scenario or dataset and asked to run a real investigation: identify the bad actor or policy violation, use OSINT to cross-reference your internal data, reach a conclusion, and write up findings with clear recommendations. This is often a take-home you then walk through live. Interviewers assess investigative rigor, documentation quality, how you separate fact from inference, and how decision-useful your recommendations are.

Example or Reported Questions

* "Here is a dataset and scenario. Investigate, identify the violating activity, and write up your findings."

* "How did you use OSINT to corroborate your internal data?"

* "What is your confidence level, and what would you do to confirm or escalate?"

* "How would you reacquire this actor if they came back under a new identity?"

Tips

* Structure your report: summary, method, evidence, assessment and confidence, recommendation. Clear, decision-useful writing wins.

* Show your work. Document sources, timestamps, and reasoning so another investigator can follow your trail.

* Separate fact from inference and state your confidence honestly rather than overclaiming.

Round 4: Behavioral, Resilience & Team Fit (30 to 45 minutes)

What to Expect

A conversation with the team, possibly including a founder or investigations lead. It covers how you operate under pressure and ambiguity, how you context-switch across abuse areas without losing rigor, how you handle on-call escalations, and, importantly, how you protect your wellbeing while working with distressing material. Expect mission and values fit too, since this is a small, high-impact team.

Example or Reported Questions

* "Tell me about a time you handled an urgent escalation outside normal hours."

* "How do you context-switch between very different abuse areas without losing rigor?"

* "How do you protect your wellbeing while working with traumatic material?"

* "Describe a time you made a judgment call with incomplete information."

* "Tell me about a high-impact investigation you are proud of."

Tips

* Prepare STAR stories on urgency and on-call, ambiguity, context-switching, and a high-impact investigation with a real outcome.

* Be candid and concrete about your wellbeing practices. It signals you can sustain the role long term.

* Show mission alignment and genuine comfort in a fast-paced, ambiguous startup.

* Use Nora AI's Behavioral Mode to tighten these stories and practice the resilience questions calmly.

Frequently Asked Questions (FAQ)

1) How many rounds are there?

Typically 3 to 4: a recruiter or intro screen, a SQL and Python technical screen, an investigations case study (often a take-home you walk through), and a behavioral plus team and mission-fit round. The exact loop varies since it is a small team.

2) Is it technical? Will I have to code?

Yes. Strong SQL and Python are core, and you will likely face a practical data and investigation exercise. It is not a leetcode loop; it is applied data work and investigative reasoning.

3) What topics are most common?

* SQL and Python data querying and transformation

* OSINT and investigative method

* Report writing and clear recommendations

* Detection pipelines and reacquiring bad actors

* Resilience with sensitive content and context-switching

* On-call readiness and AI-platform abuse awareness

4) Does the role really involve distressing content?

Yes, explicitly, including sexual, violent, and child-safety material. Interviewers will raise this directly and assess your resilience and wellbeing approach. It is fair, and smart, to ask what wellness and support resources they provide.

5) What are the logistics and requirements?

US-based with work authorization, able to work PT hours (9am to 5pm PT), remote, and willing to join the on-call rotation (about 7 consecutive days every 2 months). Around 3+ years of investigative experience is expected.

6) How should I prepare?

* Sharpen SQL (joins, window functions, aggregations) and Python data wrangling.

* Have an investigation approach ready: method, evidence, assessment, recommendation.

* Prepare STAR stories on urgency, ambiguity, and context-switching.

* Think through how you describe your wellbeing approach honestly.

* Brush up on AI-platform abuse and prompt injection.

* Practice all of it with Nora AI: Standard Mode for the screen, Technical Mode for the SQL/Python and case walkthrough, Behavioral Mode for resilience, and Salary Negotiation Mode for the comp conversation.